Malicious PDF — malware analysis report

Static analysis result for SHA-256 830d78cc8ad3d510…

MALICIOUS

PDF

91.4 KB Created: 2021-03-14 11:17:48 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: ee8aa6d5e427fd1ec9d24e898236f12a SHA-1: 7c5af4481fd0c94887c7cf5fadbee5ef4bf65501 SHA-256: 830d78cc8ad3d5107fa866187946abc13d22289c990bfec3a1fc67f5771bacca
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was identified as malicious by ML classifiers and ClamAV, indicating a phishing or trojan threat. It contains a large number of external links, suggesting a link farm or SEO manipulation tactic to direct users to potentially malicious sites. The document body, though heavily obfuscated, contains references to 'wkhtmltopdf' and a date, hinting at its generation method and potential use in automated content creation for malicious purposes.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://bologen.ru/award?keyword=baudrillard+america+pdf
    • https://cdn-cms.f-static.net/uploads/4387815/normal_600aa0301e70e.pdf
    • https://lobixeximoruse.weebly.com/uploads/1/3/5/3/135319822/vogol.pdf
    • https://static.s123-cdn-static.com/uploads/4470391/normal_6009659ba141a.pdf
    • https://waxizeno.weebly.com/uploads/1/3/0/8/130814339/31437ec8ba4c05.pdf
    • https://static.s123-cdn-static.com/uploads/4389095/normal_5fcd74898a73b.pdf
    • https://cdn-cms.f-static.net/uploads/4453118/normal_5fe8be6e7541e.pdf
    • https://cdn-cms.f-static.net/uploads/4402707/normal_6027fb509d6d3.pdf
    • https://cdn-cms.f-static.net/uploads/4376852/normal_603a254393c56.pdf
    • https://cdn-cms.f-static.net/uploads/4368501/normal_603a40a58bf3e.pdf
    • https://static.s123-cdn-static.com/uploads/4488556/normal_6005fc3999b21.pdf
    • https://cdn-cms.f-static.net/uploads/4458625/normal_602c54b504304.pdf
    • https://cdn-cms.f-static.net/uploads/4422914/normal_604b77472748c.pdf
    • https://cdn-cms.f-static.net/uploads/4426819/normal_6046eb58344d1.pdf
    • https://rokubupudila.weebly.com/uploads/1/3/1/8/131856034/34dd7a3dfeb.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://493f174a-a540-412c-bacb-e5b7b26cbfcf.filesusr.com/ugd/95bb70_208dfaa901364becae6df5f9f2b05561.pdf?index=true
    • https://8c4778c4-ed17-4cf1-86f9-5448e21c5c15.filesusr.com/ugd/6da380_6a2b1db8e8df4330aac557b64a9deefd.pdf?index=true
    • https://33c7e2ec-32fc-4676-a642-9d95a4379e01.filesusr.com/ugd/622218_8e31d7bb0f1542d2a53d33554ded056b.pdf?index=true
    • https://97d49ff2-d914-4ae4-8ac8-5e5cf5f77cad.filesusr.com/ugd/6350c7_4f79817788e5457da43732c4fa802be8.pdf?index=true
    • https://e809654a-a95b-4dbc-a338-24085255a2f8.filesusr.com/ugd/1b6cec_32952ad4d33e46eaba131d55a3c8a8ef.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00011c5a.bin
e52e87539d6a2e43da74dd81ca3d521c4b641873b5d525de26f040c39d34ed6b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11C5A 4760 bytes
font_01_sfnt_off00012c7c.bin
f6d4648c377af69b7c86038d423eec7e0860b77a9a6465169b64951819f4cac4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12C7C 11236 bytes
font_02_sfnt_off0001527f.bin
7f6049e5011acf0e8581793f2bc2bb947aac2929fdb77abc318b2a6155c1ef71		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1527F 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.